Java Trojan on OSX

Question

Hello,
I get updated notes as a memeber of SC Magazine which specialises in security risks across different platforms.
Yesterday I had notification that Apple have found a hole in its Java Scripting
This is what it says:-
After security researchers spotted active exploits taking advantage of the vulnerability, the update, for both Lion (10.7.3) and Snow Leopard (10.6.8) versions of the platform, was released to close a dozen holes in Java 1.6.0_29. Apple said the most serious may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.
That presumably refers to CVE-2012-0507, which researchers at Mac security firm Intego said was the latest variant of the password-stealing Flashback Trojan.
Intego said it had samples of variant ‘R' since 23March and had been finding new samples and variants of this malware almost daily since then. It recommended Mac users turn off Java in their web browser.
It also said Java is no longer provided with Mac OS X 10.7 Lion, but the first time a user needs to run it – when a Java applet loads, or when a user launches a Java applet on their Mac – the system will ask if the user wants to download it; if so, Apple provides the download directly and maintains its own version of Java.
Wolfgang Kandek, CTO of Qualys, said: “In addition, Mac users and IT admins for Macs should review whether Java is actually needed for their usage. If not, Java can be disabled through the Java Preferences program. Just uncheck 64-bit and 32-bit versions.”
Unpatched Java deployments are one of the largest malware threats facing enterprises today, according to Microsoft.
So my questions are :-
1) How do I ensure that Java is secure, as it states that I need to lock down and uncheck the the Java on 32 or 64bit versions
2) Is it now expedient to purchase Anti _Virus software for OSX?
Thanks  David

Answer 1

jricketts wrote:
X423424X wrote:
These things can't keep up with the ever changing trojans anyhow and there are no known viruses on OSX.
Can you back that up? I'm thinking that's an incorrect statement. While there are not as many targeted towards Mac OS X as there are towards Windows, I would think it is errant to think that none exist or that an Apple computer is immune from being affected. The piece of malware that inspired this thread is a good example of a known threat. While it's a trojan horse and not specifically a computer virus, and indeed other major threats to Mac OS X have been worms and similar malware, I think it is prudent for all Apple users to be aware of threats to their systems and to take actions to safeguard them.
There have been viruses in the past, but all known viruses have been patched on an up-to-date OS X 10.6.8 and above. That does not include any other malware, but the kind that can infect without user interaction is currently in check. If somebody wants to argue that there was a viral Trojan being served over the past week or so, I would have to agree. I also agree with everything else you have said.
Additionally, I think it wouldn't be a bad idea to install an anti-virus onto a computer running Mac OS X. Just because the malware out there is increasing at a rate faster than you think AV vendors can keep up with is no reason to not have even basic protection.
As long as it doesn't adversely affect the operation of your computer and does not give one a false sense of security, I don't have a problem with that. I have four installed on my computer right now, but none of them are currently running.